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This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

Claim 1 (original): A method suitable for use in a commxmication device for determining the 
disposition of incoming e-mail from a sender, said method comprising the steps of: 

establishing the identity of the sender to provide a sender identifier; 

determining a cumulative penalty count value associated with said sender identifier; 

retrieving a system resource usage status associated with the communication device; and 

processing the incoming e-mail on the basis of said cumulative penalty count value and 
said system resource usage status. 

Claim 2 (original): The method of claim 1 wherein said step of establishing the identity of the 
sender comprises the step of ascertaining an IP address for the sender. 

Claim 3 (original): The method of claim 1 wherein said step of establishing the identity of the 
sender comprises the step of associating the sender with a peer IP address of the sender TCP 
connection. 

Claim 4 (original): The method of claim 1 wherein said step of determining a cimiulative 
penalty count value comprises the step of assessing a penalty count value to said sender identifier 
for an undesirable activity associated with the sender. 

Claim 5 (original): The method of claim 4 wherein said cumulative penalty count value 
comprises an activity penalty count charged to the sender for cxirrent undesirable sender activity 
and a time-dependent penalty count determined from previous undesirable sender activity. 

Claim 6 (original): The method of claim 5 wherein said time-dependent penalty count comprises 
a zero value subsequent to a pre-established retention period. 
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Claim 7 (original): The method of claim 5 wherein said time-dependent penalty count comprises 
a prior activity penalty count value reduced by a decay factor. 

Claim 8 (original): The method of claim 4 wherein said undesirable activity comprises a 
member of the group consisting of: sending a large number of e-mails, sending emails of 
relatively large sizes, using a relatively large amoxmt of TCP connection time, and causing a TCP 
timeout. 

Claim 9 (original): The method of claim 1 wherein said system resource usage status is a 
function of a member of the group consisting of: the number of concurrent TCP connections 
being maintained, the number of e-mail files in an incoming message queue, and the amount of 
disk space being utilized for an incoming message queue. 

Claim 10 (original): The method of claim 1 wherein said step of processing the incoming e-mail 
comprises the step of assigning an operating state to the communication device, said operating 
state being a function of said system resource usage status. 

Claim 11 (original): The method of claim 10 wherein said operating state is a member of the 
group consisting of: a normal operating state, a selective-rejection operating sate, and a random- 
rejection operating state. 

Claim 12 (original): The method of claim 11 wherein, for said selective-rejection state, if said 
cumulative penalty count value has a zero value, said step of processing the incoming e-mail 
comprises the step of accepting the incoming e-mail. 

Claim 13 (original): The method of claim 11 wherein, for said selective-rejection state, if said 
cumulative penalty count value has a nonzero value, said step of processing the incoming e-mail 
comprises the steps of: 

specifying a rejection factor; 
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generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said rejection factor and said 
random number. 

Claim 14 (original): The method of claim 13 wherein said step of randomly rejecting comprises 
the step of accepting the incoming e-mail if said random number is greater than said rejection 
factor and rejecting the incoming e-mail if said random number is not greater than said rejection 
factor. 

Claim 15 (original): The method of claim 13 wherein said rejection factor is increased if said 
system resource usage status increases and said rejection factor is decreased if said system 
resource usage status decreases. 

Claim 16 (original): The method of claim 11 wherein, for said random-rejection state, if said 
cumulative penalty count value has a nonzero value, said step of processing the incoming e-mail 
comprises the step of rejecting the incoming e-mail. 

Claim 17 (original): The method of claim 11 wherein, for said random-rejection state, if said 
cumulative penalty count value has a zero value, said step of processing the incoming e-mail 
comprises the steps of: 

deriving a resource usage factor; 

generating a random number; and 

randomly rejection the incoming e-mail on the basis of said resource usage factor, said 
random number, and said cumulative penalty count value. 

Claim 18 (original): The method of claim 17 wherein said step of randomly rejecting comprises 
the step of accepting the incoming e-mail if said random number is greater than a product of said 
resource usage factor and said cumulative penalty coimt value, and rejecting the incoming e-mail 
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if said random nximber is not greater than said product of said resource usage factor and said 
cumulative penalty count value. 

Claim 19 (original): The method of claim 18 wherein said resource usage factor is increased if 
said system resource usage status increases and said resource usage factor is decreased if said 
system resource usage status decreases. 

Claim 20 (original): A communication device for determining the disposition of incoming e- 
mail from a sender, said device comprising: 
a penalty count filter module having 

means for identifying the sender; 

means for assigning a penalty count to the sender, said penalty count being 

a function of undesirable activity associate with the sender; 
means for determining a resource usage value for said commxmication 

device in receiving e-mail; 
means for specifying an operating state for penalty count filter module, 

said operating state being a function of said resource usage value; 

and 

an accept/reject filter for disposing of the incoming e-mail on the basis of 
said sender penalty count and said operating state. 

Claim 21 (original): The device of claim 20 wherein said means for identifying the sender 
includes means for obtaining at least one of a Domain Name Service verification and a peer IP 
address of the sender TCP connection. 

Claim 22 (original): The device of claim 20 wherein said imdesirable activity comprises a 
member of the group consisting of: sending a large number of e-mails, sending e-mails of 
relatively large sizes, using a relatively large amoxmt of TCP cormection time, and causing a TCP 
timeout. 
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Claim 23 (original): The device of claim 20 wherein said system resource usage status is a 
function of a member of the group consisting of: the number of concurrent TCP connections 
being maintained, the number of e-mail files in an incoming message queue, and the amount of 
disk space being utilized for an incoming message queue. 

Claim 24 (original): A communication device for determining the disposition of incoming e- 
mail firom a sender, said device comprising: 

a sender penalty count data structure for storing a cvirrent penalty count value associate 
with the sender; 

a system resource usage status file for storing a current usage status value for device e- 

mail processing resources; and 
an accept/reject filter for disposing of the incoming e-mail on the basis of said penalty 
count value and said usage status. 
Claim 25 (original): The device of claim 24 wherein said sender penalty count data structure 
includes an entry comprising a member of the group consisting of: a sender identification value, 
a cumulative penalty coimt value, a cumulative e-mail count, a total e-mail size, a total TCP 
connection time, and a timestamp value. 

Claim 26 (original): A method suitable for use in a conmiunication device for determining the 
disposition of incoming e-mail fi*om a sender, said method comprising the steps of: 
identifying the e-mail sender by determining a sender IP address; 

obtaining a previous sender penalty coimt value calculated for said sender IP address; and 
accepting or rejection the incoming e-mail based on said sender penalty count value. 

Claim 27 (original): The method of claim 26 further comprising the steps of: 
maintaining a behavior trace table entry for the e-mail sender; and 
determining said previous sender penalty count firom said behavior trace table. 
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Claim 28 (original): The method of claim 27 further comprising the step of updating sender 
behavior values in said trace table entry in response to receipt of a sender e-mail. 

Claim 29 (original): The method of claim 28 wherein said sender behavior values include a 
member of the group consisting of: the number of e-mails, the total size of e-mails, and the total 
time of TCP connection time. 

Claim 30 (original): The method of claim 28 wherein said step of updating sender behavior 
values comprises the steps of: 

reducing said behavior trace table value by a decay factor; and 

adding a current behavior trace table value to said corresponding reduced behavior trace 
table value. 

Claim 31 (original): The method of claim 30 wherein said decay factor is a function of the time 
interval between the last two updates of said behavior trace table entry and a pre-established 
retention period. 

Claim 32 (original): The method of claim 26 wherein said sender penalty count value is 
determined from imdesirable sender activity occurring over a pre-established retention period. 

Claim 33 (original): The method of claim 32 wherein said undesirable activity comprises a 
member of the group consisting of: sending a large number of e-mails, sending e-mails of 
relatively large sizes, using a relatively large amount of TCP cormection time, and causing a TCP 
timeout. 

Claim 34 (original): The method of claim 26 further comprising the step of updating said sender 
penalty count value. 
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Claim 35 (original): The method of claim 34 wherein said step of updating said sender penalty 
count value comprises the steps of: 

reducing said previous sender penalty count value by a decay factor to yield a reduced 
sender penalty coxmt value, said decay factor being a function of said pre- 
established retention period; and 
adding an activity penalty coxmt value to said reduced sender penalty count value to yield 
an updated sender penalty count value, said activity penalty count value 
calculated as a function of current sender e-mail activities. 

Claim 36 (original): The method of claim 35 wherein said decay factor is further a function of 
the time interval between calculation of said previous sender penalty count value and calculation 
of said activity penalty count value. 

Claim 37 (new): A method for by a conmiunication device for determining the disposition of 
incoming e-mail from a sender, said method comprising steps of: 
establishing an identity of the sender; 

determining a penalty count value associated with said identity, wherein said cximulative 

penalty coimt is based on a behavior of the sender; 

retrieving a system resource usage status associated with the communication device; and 
processing the incoming e-mail based on the penalty count value and the system resource 

usage status. 

Claim 38 (new): The method of claim 37, wherein said step of establishing the identity of the 
sender comprises the step of ascertaining an IP address of the sender. 

Claim 39 (new): The method of claim 37, wherein said step of determining a cimiulative penalty 
count value comprises the step of assessing a penalty count value to said sender identity based on 
an undesirable activity performed by the sender. 
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Claim 40 (new): The method of claim 37, wherein said cumulative penalty count value 
comprises a prior penalty count value reduced by a decay factor. 

Claim 41 (new): The method of claim 37 wherein said step of processing the incoming e-mail 
comprises the step of assigning an operating state to the communication device, said operating 
state being a function of said system resource usage status. 

Claim 42 (new): The method of claim 41 wherein said operating state is a member of the group 
consisting of: a normal operating state, a selective-rejection operating sate, and a random- 
rejection operating state. 

Claim 43 (new): The method of claim 41, wherein said operating state comprises a selective- 
rejection state, and wherein if said cumulative penalty count value has a zero value, said step of 
processing the incoming e-mail comprises the step of accepting the incoming e-mail. 

Claim 44 (new): The method of claim 41 wherein said operating state comprises a selective- 
rejection state, and wherein if said cumulative penalty covmt value has a nonzero value, said step 
of processing the incoming e-mail comprises the steps of: 

specifying a rejection factor; 

generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said rejection factor and said 
random number. 

Claim 45 (new): The method of claim 44 wherein said step of randomly rejecting comprises the 
step of accepting the incoming e-mail if said random number is greater than said rejection factor 
and rejecting the incoming e-mail if said random number is not greater than said rejection factor. 
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Claim 46 (new): The method of claim 44 wherein said rejection factor is increased if said 
system resource usage status increases and said rejection factor is decreased if said system 
resource usage status decreases. 

Claim 47 (new): The method of claim 41 wherein said operating state comprises a random- 
rejection state, and wherein if said cximulative penalty count value has a nonzero value, said step 
of processing the incoming e-mail comprises the step of rejecting the incoming e-mail. 

Claim 48 (new): The method of claim 41 wherein said operating state comprises a random- 
rejection state, and wherein if said cumulative penalty coimt value has a zero value, said step of 
processing the incoming e-mail comprises the steps of: 

deriving a resource usage factor; 

generating a random number; and 

randomly rejection the incoming e-mail on the basis of said resource usage factor, said 
random number, and said cumulative penalty count value. 

Claim 49 (new): The method of claim 48 wherein said step of randomly rejecting comprises the 
step of accepting the incoming e-mail if said random number is greater than a product of said 
resource usage factor and said cumulative penalty count value, and rejecting the incoming e-mail 
if said random number is not greater than said product of said resource usage factor and said 
cumulative penalty coxmt value. 

Claim 50 (new): The method of claim 49 wherein said resource usage factor is increased if said 
system resource usage status increases and said resource usage factor is decreased if said system 
resource usage status decreases. 
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